Privacy Policy

---

Divergent Financial Planning recognizes that trust is an integral part of our working relationship. We are fully aware and compliant with the laws governing the handling of your personal and confidential information. 

This includes, but is not limited to:

• PIPEDA The Personal Information Protection and Electronic Documents Act (Canada)
• CASL Canada’s anti-spam legislation (2014)
• GDPR General Data Protection Regulation (EU) (May 28, 2018)

Protecting your privacy and the confidentiality of your personal information is a fundamental principle of our relationship with you. Divergent Financial Planning complies with the legislation and regulations referenced above and is committed to the lawful storage, protection, accuracy and use of Personal Information collected and controlled by us.

Divergent Financial Planning has established procedures to implement this Privacy Policy, including:

• procedures to protect Personal Information; and,
• procedures to receive and respond to complaints and inquiries.

The 10 Principles of Fair Information Practices

• Accountability: An organization is responsible for personal information under its custody and      shall designate an individual or individuals who are accountable for the organization's compliance with the following principles.
• Identifying Purposes: The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.
• Consent: The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate.
• Limiting Collection: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.
• Limiting Use, Disclosure and Retention: Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.
• Accuracy: Personal information shall be as accurate, complete and up to date as is necessary for the purposes for which it is to be used.
• Safeguards: Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
• Openness: An organization shall make readily available to individuals’ specific information about its policies and practices relating to the management of personal information.
• Individual Access: Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information, and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
• Challenging Compliance: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization's compliance.

Collection and Use

Divergent Financial Planning collects personal information for these primary purposes:

• to gather all necessary and appropriate information required to properly serve clients’ needs and provide our services as mutually agreed upon.
• to  send our newsletter and/or other forms of electronic communications to those who have wilfully opted into the receipt of said communications.

Limiting Collection, Use, Disclosure and Retention

Personal Information is collected as is reasonably and practically required to fulfill the purposes identified, for example to respond to a request for information requested on the Contact page of our website or to prepare client work as so engaged.

Divergent Financial Planning does not use or disclose Personal Information for purposes other than those for which it is collected and in direct alignment with client contracts and engagements. We retain Personal Information for only as long as necessary to serve that purpose. Divergent Financial Planning does not sell or rent any personally identifiable information about you to a third party, nor do we share or solicit the information captured in any way without your express consent. 

We do employ or contract with third parties to perform tasks on our behalf and we may need to share Account Information and other Personal Information with them to provide certain services. Unless we tell you differently, such third parties do not have any right to use the Personal Information we share with them beyond what is necessary for them to provide the tasks and services on our behalf. The third parties we currently engage includes third party companies and individuals contracted by us to facilitate our services, including the provision of financial planning software tools, database management, payment processing, and customer relationship management tools. 

If our business (or substantially all of our assets) are acquired by a third party, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information may be made available or otherwise transferred to the new controlling entity, where permitted under applicable law.

We may disclose your Personal Information to third parties without your consent if we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. Further, we may disclose Personal Information when we believe in good faith that such disclosure is required by and in accordance with the law.
 

We also reserve the right to access, read, preserve, and disclose any information as we reasonably believe is necessary to:
 

• satisfy any applicable law, regulation, legal process or governmental request; enforce our contracts, as well as investigation of potential violations of such contracts; and
• detect, prevent, or otherwise address fraud, security or technical issues.

The above may include exchanging information with other companies and organizations for fraud protection and spam/malware prevention. Notwithstanding the general terms of this policy, the collection, use, and disclosure of Personal Information may be made outside of the terms herein to the extent provided for in any applicable privacy or other legislation in effect from time to time, or pursuant to court orders.

Consent

Consent for the collection of personal information can be either express or implied. Express consent is either given verbally or in writing, e.g. when providing information on the Contact page on our website or opting into our newsletter.

It is understood that information gathered from visits to our website may be used to statistically analyze usage of the website and to make improvements to our website content. If you provide your contact information on our website, we may use your email address to contact you directly from time to time. Under no circumstances is information from our Contact page added to a mailing list or used for mass marketing purposes.

As you may be aware, the General Data Protection Regulation (GDPR) came into effect on May 25th, 2018. While this is a European Union regulation, it expands on the Canadian privacy legislation already in place. Compliance with all privacy regulations is key to respecting your privacy and ensuring the security of your data.

Special note with respect to the GDPR (Privacy legislation for the EU, effective May 28, 2018)

The GDPR has added additional control for EU citizens over their personal information regardless of which country that information is used in, meaning all countries are required to abide by the GDPR when dealing with, or potentially dealing with personal information from an EU citizen. 

The legal basis on which Divergent Financial Planning relies to process Personal Information (known as "Personal Data" under the European Union's General Data Protection Regulation) are consent, fulfillment of our contracts and engagements with clients, as well as pursuit of legitimate business activities.
 

Where we collect Personal Data directly from the data subjects, such as our customers, and make decisions in regard to processing such Personal Data, we act as the data controller. Otherwise, where we process Personal Data on behalf of third parties (such as when our customers use the Services to process Personal Data of their clients), we are the data processor.
 

If you are a resident of the EEA, you have certain data protection rights. Divergent Financial Planning takes reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data. If you wish to be informed of what Personal Data we hold about you and if you want it to be removed from our systems, please contact us using the contact information set out below. Note that where we act as the data processor on behalf of a customer, you will be required to contact the data controller directly to exercise your rights.
 

In certain circumstances, where we act as data controller, you have the following data protection rights:
 

• Request access to your Personal Information (commonly known as a "data subject access request"). This enables you to receive a copy of the Personal Information we hold about you where we are the data controller and to check that we are lawfully processing it.
   
• Request correction of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us.
   
• Request erasure of your Personal Information. This enables you to ask us to delete or remove Personal Information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Information where you have successfully exercised your right to object to processing (see below), where we may have      processed your information unlawfully, or where we are required to erase your Personal Information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
   
• Object to processing of your Personal Information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental      rights and freedoms. You also have the right to object where we are processing your Personal Information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
   
• Request restriction of processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information in the following scenarios: (a) if you want us to establish the information's accuracy; (b) where our use of the information is unlawful but you do not want us to erase it; (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
   
• Request the transfer of your Personal Information to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
   
• Withdraw consent at any time where we are relying on consent to process your Personal Information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Please note that we may ask you to verify your identity before responding to such requests.
 

You have the right to complain to a data protection authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the EEA.
 

If you wish to exercise any of the rights set out above, please contact us using the contact details below.

Accuracy

Divergent Financial Planning endeavours to keep Personal Information as accurate, complete and up to date as necessary for the purposes for which it is to be used.

Security

Divergent Financial Planning protects Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification with security safeguards appropriate to the sensitivity of the Personal Information. Our Cyber Security Policy is adhered to, updated, and reviewed on a semi-annual basis. Divergent Financial Planning. protects Personal Information regardless of the format in which it is held.

The methods of protection for Personal Information include, but is not limited to:

• while rare in the virtual environment, any physical documents are shredded when no longer needed, and are kept in a secure location when they are being used; and,
• organizational measures, access to electronic records on a need-to-know basis; and
• personnel training on Privacy and Security Policy and signed confidentiality agreements; and
• technological measures, such as sharing of passwords only through an encrypted password      management system; the use of multi-factor authentication wherever possible; not exchanging documents through non-secure channels; using encrypted VPNs to access client information; maintaining system security to guard against cyber threats; and
• Secure storage of equipment used for work purposes when not in use. 

Transparency and Access

Divergent Financial Planning makes specific information about its policies and practices relating to the management of Personal Information readily available to clients. Divergent Financial Planning. is open about its policies and procedures as they relate to the handling of Personal Information. 

Changes to our Privacy Policy

We may amend this Privacy Policy from time to time. Use of Personal Information we collect is subject to the Privacy Policy in effect at the time such information is collected, used or disclosed. If we make material changes or changes in the way we use Personal Information, we will notify you by posting an announcement on our website or sending you an email prior to the change becoming effective. You are bound by any changes to the Privacy Policy when you use the Website or Services after such changes have been first posted.

Any inquiries should be addressed to:

Privacy Officer, Divergent Financial Planning

Mail: PO Box 21008, Lethbridge, AB, Canada T1K 6X4

Phone: +1 587 205 9805

Email: privacy@divergentfp.ca

Every client has the right to request access to their Personal Information and the right to have Personal Information deleted or modified.